D3/100
Breach · high
Hackers steal up to $133 million from Crédit Mutuel Arkéa via third-party service provider
Tier D · Background noise – Good to know
Who’s exposed: Crédit Mutuel Arkéa accounts reached through its third-party service provider
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild
The Brief
- Hackers used a third-party service provider to make fraudulent transactions from Crédit Mutuel Arkéa's own account, with losses of up to $133 million.
- Crédit Mutuel Arkéa, a French cooperative bank, was hit by the cyberattack and suspended certain systems in response.
- Security Affairs reported the bank's statement that the provider was exploited to carry out the theft.
Why it matters
The breach shows that a compromised third-party provider can give attackers direct access to a bank's accounts and move very large sums, so vendor access needs the same scrutiny as internal systems.
The checklist behind the tier
Checklist · 1 of 10 yes
| No | Hits tech teams | Judgment: a French bank's internal payment systems breach, not software developers or ops teams run. |
| No | Core infrastructure | Judgment: a single bank's compromise, not widely shared core infrastructure like OpenSSH or GitHub. |
| No | Popular tool | Judgment: a regional bank's incident, not a widely used framework, tool, platform or package. |
| Yes | Exploited in the wild | BleepingComputer: cyberattack enabled fraudulent transactions of up to $133 million at the bank. |
| No | Public exploit | Neither source mentions published exploit code or proof-of-concept. |
| No | Remote, no login | Neither source states how the attackers gained access or whether credentials were needed. |
| No | Full takeover | Sources describe fraudulent transactions using the bank's account but do not state code execution or admin takeover. |
| No | Secrets exposed | Sources report fraudulent transfers, not stolen credentials, keys, configs or customer data exposure. |
| No | Supply chain | Security Affairs: attackers exploited a service provider; no source says a legitimate package or update was compromised. |
| No | No fix yet | Neither source mentions the vulnerability or whether a patch exists. |
Timeline
Attack on Crédit Mutuel Arkéa reported by BleepingComputer
BleepingComputer
Hackers pull off $133 million French bank heist via service provider
Security Affairs
Attackers Exploit Third-Party Provider to Raid French Bank Crédit Mutuel Arkéa
Full coverage · 2 sources
First seen · 2 sources · Full story page · How tiers are decided